CVE-2026-45765 OISF CVE debrief

Who should care

Defenders responsible for network security, intrusion detection, and prevention systems should assess exposure and prioritize updates or workarounds. This includes operators of Suricata-based systems, security teams, and vulnerability management teams who need to review the potential impact on their systems and take necessary actions to mitigate the vulnerability.

Why it matters

Defenders should care about CVE-2026-45765 because it affects Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. Crafted DNP3 traffic could cause excessive memory consumption, potentially resulting in denial of service. The issue is addressed in versions 7.0.16 and 8.0.5, and defenders should prioritize updates or apply workarounds.

• Denial of service due to excessive memory consumption
• Potential disruption of network security monitoring and intrusion detection capabilities
• Need for verification of affected versions and exposure
• Priority for updating or applying workarounds

Technical summary

The vulnerability in Suricata could allow crafted DNP3 traffic to cause excessive memory consumption, potentially resulting in denial of service. The issue is addressed in versions 7.0.16 and 8.0.5. Suricata's DNP3 reassembly feature could buffer data without sufficient parser-level bounds, leading to potential denial of service. Defenders should prioritize updating Suricata to versions 7.0.16 or 8.0.5, or applying workarounds such as disabling DNP3 if not needed, and defining a limited `stream.reassembly.depth`. This vulnerability affects Suricata's network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine capabilities.

Defensive priority

Defenders should prioritize updating Suricata to versions 7.0.16 or 8.0.5, or applying workarounds such as disabling DNP3 if not needed, and defining a limited `stream.reassembly.depth`.

Recommended defensive actions

• Update Suricata to version 7.0.16 or 8.0.5
• Disable DNP3 if not needed
• Define a limited `stream.reassembly.depth`
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.